21

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:

Windows Defender SmartScreen prevented an unrecognized app from starting

The warning goes away only after the certificate builds a reputation:
Smart-Screen filter still complains, despite I signed the executable, why?

But we are signing our software (WinSCP) with DigiCert code signing certificate for years. It is a plain certificate, no Extended Validation (EV).

As our certificate is expiring soon, we have renewed it. But now, signed with the renewed certificate, our software triggers the SmartScreen warning.

Is that expected? Is the reputation really not transferred to the renewed certificate? If not, what does it take to build the reputation again? The new (beta) version of our software (signed with the renewed certificate) is out for few days already, and it has tens of thousands of installations, but it still triggers the warning. Or is there a way to help the reputation to transfer somehow?

We have tried to submit the files for malware analysis to Microsoft. Although the binaries passed the tests, it did not have visible effect on the SmartScreen check.

Improve this question
11
  • 2
    We face this situation each time we renew our Authenticode certificate. Without EV, you must build the reputation from the scratch.
    – Jozef Izso
    Commented Dec 2, 2019 at 11:26
  • 1
    It takes few weeks while we use our internal builds and no longer than month.
    – Jozef Izso
    Commented Dec 2, 2019 at 13:16
  • 1
    More here... blogs.msdn.microsoft.com/ie/2012/08/14/… However, how long does it take to build reputation for a new certificate?
    – Petr
    Commented Dec 2, 2019 at 21:39
  • 4
    Yes, we must use the software internally long enough so customers do not face the SmartScreen information. Usually we don't see it after few days when up to 10 people use it.
    – Jozef Izso
    Commented Dec 5, 2019 at 9:37
  • 1
    @JozefIzso Only ~ 10 people is enough such that future customers won't see it again?
    – Basj
    Commented Sep 8, 2020 at 9:30

4 Answers 4

Reset to default
10

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for weeks again.

It does not look like a standard code signing certificate can be used nowadays. We gave up and went for EV certificate.

Improve this answer
7
  • 1
    Thank you for this answer @MartinPrikryl. A few details: (1) "The binary became trusted after about one month.": just to get the order of magnitude, how many downloads / installs by end users were needed? (I think that's this count that increases the reputation, is that right?) -- (2) "the further release become trusted after about 10 days only, third release did not become trusted for weeks again": does this mean that if mysoftware-v.1.0.1.exe is finally trusted, then you start with reputation=0 again for mysoftware-v.1.0.2.exe, really?
    – Basj
    Commented Sep 8, 2020 at 9:08
  • @Basj Yes, that's what our experience was like. + As my question says, the respective (beta) releases had several tens of thousand downloads.
    – Martin Prikryl
    Commented Sep 8, 2020 at 9:24
  • 1
    Thanks for your answer. So I can't expect to see the SmartScreen messages disappear for my users if, say, only 100 users have downloaded it? Do you confirm this comment? "Usually we don't see it after few days when up to 10 people use it. – Jozef Izso"
    – Basj
    Commented Sep 8, 2020 at 9:29
  • PS: before going the EV certificate route, did you try microsoft.com/en-us/wdsi/filesubmission, did it help?
    – Basj
    Commented Sep 8, 2020 at 9:29
  • No, I do not confirm that comment. + Yes, we tried the file submission. It did not help.
    – Martin Prikryl
    Commented Sep 8, 2020 at 9:42
3

As you've figured out you can't transfer it, and you're stuck without using EV. Because you've got a new certificate, it took some time for your software to be verified as safe. What I think is happening now is that your signing certification is still seen as relatively new, and needs to build up reputation, but because the previous software release was all ok I would expect that reputation build up is quicker this time.

The only definite way to speed this up is to get EV certificates. However, by submitting new releases here: https://www.microsoft.com/en-us/wdsi/filesubmission you may be able to increase reputation. This blog has some interesting statistics and spotted some potential patterns: https://www.coretechnologies.com/blog/windows/microsoft-smartscreen-filter/

One potential way to get around this, at least relatively recently, was to have an installer that changes code very infrequently. This code then downloads the program in the background and this would often work. Unfortunately, I don't think that's going to work for WinSCP (which is very useful btw, keep up the good work!).

Improve this answer
3
  • Thanks for your response. I have posted the first version of WinSCP signed with the renewed certificate to Microsoft already, right after the release, after the problem appeared. Though after the message did not go away in few days, I've withdrew that release. So I cannot really tell what impact, if any, it had. – I've submitted the new version of WinSCP now too, just in case... – The blog post is rather dated. SmartScreen is now built-in in Windows 10 and the check is triggered, no matter what browser you use to download the file.
    – Martin Prikryl
    Commented Jan 8, 2020 at 8:50
  • Yes, unfortunately soz which is why I doubt the second solution works now.
    – LTPCGO
    Commented Jan 8, 2020 at 10:15
  • That file submission page is quite discouraging. In particular it requires "Detection name *" if you select "Incorrectly detected as malware/malicious:". It doesn't seem appropriate to submit new software at all.
    – O'Rooney
    Commented Jun 8, 2021 at 4:09
2

This is an answer from Microsoft received in 2020: It seems the most important advice is to get the new code signing certificate before preivous expires. So the new one have time to gain reputation. Last time I got the new cert to get reputation in about 30 days.

To give you some additional background, when a certificate is renewed, or if a new certificate is used to sign files, fresh reputation needs to be established. The reputation of the previous certificate is one of the important elements in attaching reputation to the newer certificate. Typically, a renewed certificate will establish reputation more quickly than a completely new certificate such as one from a different CA or one which uses different organization details (company name, etc.). For future reference, here are some suggestions to help establish reputation for a new or renewed certificate:

· When using a new certificate (or even renewing a cert), use the same information (Name, email contact address, etc.) that was used for an older, established certificate

· Use the new certificate to sign an already established application

· Sign a new application with an already established certificate

· Ensure that applications signed with the new certificate are accessible (rather than remaining on an intranet, for example)

· Do not create many different certificates for signing applications. Use a limited number of certificates, and ensure that applications that are signed with them are not vulnerable to compromise

· Consider renewing the certificate a little early and signing a few of your applications with it before your existing certificate expires

Improve this answer
1

We got our reputation back 3 days after updating our OV certificate.

We offer software (TexturePacker, BabelEdit,...) since about 10 years. The code signing certificates we use are OV certificates with the duration of 3 years.

With the last TexturePacker release with the updated certificate on 2023-02-02, we got hit by the reputation issue.

What we've done to get the reputation back:

  • Uploaded TexturePacker to our page - also enabled it in our auto updater. But we did not present it on the page to prevent confusion for new users.
  • Opened the download in Edge. Edge warns and you can select an option to tell Microsoft that this is a false positive
  • Fill the form at Microsoft, describing that this is a certificate update and that you are the owner of the software.
  • Wait 2-3 days (it was over a weekend - maybe it's even faster on working days)
  • Receive an email that SmartScreen is updated

We've enabled the regular download and everything is ok. No smart screen warning.

We've also tested uploading a nightly build of BabelEdit signed with the new certificate. That was fine, too.

So it seems that Microsoft accepted the new certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .